I'd be willing to guess that the vast majority of applications (if not all) dependent on core-js are pulling it in as a transitive dependency of something else-

I'd be willing to guess that the vast majority of applications (if not all) dependent on core-js are pulling it in as a transitive dependency of something else-- most via either a direct dependency on `@babel/preset-env` or indirect dependencies on the same through scaffolding projects like create-react-app. That leaves core-js in a position where it's kind of invisible-- projects like Babel are very visible and pull in a decent chunk of cash via developer donations and corporate sponsorships. Core-js, on the other hand, isn't something most developers ever deal with directly-- if you don't go and dig through your dependency tree, you may never even know it's there. Until it starts making noise in your console on 'npm install', at least-- and then it looks indistinguishable from spam, from something you never even explicitly installed, no less.